Threat Database Viruses Virus.Wapomi.B

Virus.Wapomi.B

By CagedTech in Viruses
Published:
Translate To:

Virus.Wapomi.B is identified as a member of the Viruses category of malicious software. As with many threats in this category, it is designed to infect files on a computer and spread itself to other systems, often without the user's knowledge or consent. Because detailed technical specifics about this particular variant are not confirmed, the following description reflects the typical behavior of file-infecting viruses and worm-type threats in this category, which Virus.Wapomi.B is believed to share.

What This Threat Does

Threats classified in the Viruses category, such as Virus.Wapomi.B, generally work by attaching malicious code to executable files or other legitimate programs stored on the infected machine. Once a file is infected, running it can trigger the virus to activate, allowing it to spread further across the system and potentially to other connected devices or drives. Viruses of this type commonly attempt to replicate themselves, infecting as many files as possible, which can make full removal more difficult the longer the infection persists.

In many cases, threats like this are also used as a delivery mechanism for additional malicious payloads. This can include downloading or installing other unwanted or harmful programs onto the compromised computer, which may expand the scope of damage beyond the initial infection.

How It Usually Gets Onto Computers

Viruses in this category typically spread through infected removable media, such as USB flash drives, external hard disks, or shared network drives. They may also be distributed through pirated software, cracked program installers, or files shared on peer-to-peer networks. Email attachments, malicious downloads from untrustworthy websites, and bundling with other software can also serve as common infection vectors for this type of threat. Because the exact distribution methods specific to Virus.Wapomi.B have not been confirmed, users should remain cautious of all of these typical infection routes.

Risks for the User

An infection of this type can pose several risks to the affected computer and its user. These may include degraded system performance, instability, or crashes caused by corrupted files. Since viruses in this category often spread to other files and drives, there is a risk of widespread damage across a system or network if the infection is not addressed promptly. Additionally, because such threats can be used to introduce further malicious software, users may face secondary risks such as data theft, unauthorized access, or additional infections stemming from the payloads delivered by the virus.

Signs of Infection

Users may notice several warning signs if their computer has been affected by a virus of this nature. These can include unexpected slowdowns, programs failing to open or crashing unexpectedly, unfamiliar files appearing on the system, or an increase in disk or network activity without a clear cause. Security software may also flag suspicious files as infected or quarantine them automatically. Any unexplained changes in system behavior should be treated as a potential indicator of infection.

How to Stay Protected

To reduce the risk of infection from Virus.Wapomi.B and similar threats, users should avoid downloading software from untrustworthy or unofficial sources, and exercise caution when using removable media from unknown origins. Keeping the operating system and installed software up to date helps close security gaps that malware may exploit. Regularly scanning the system with updated security tools, avoiding suspicious email attachments, and backing up important files can further help minimize the impact of a potential infection and support quicker recovery if one occurs.

Analysis Report

General information

Family Name: Virus.Wapomi.B
Packers: ASPack v2.12
Signature status: No Signature

Known Samples

MD5: 1aa4c64363b68622c9426ce96c4186f2
SHA1: 6d30a08e63beec01478959d96a792d43bf03fb23
SHA256: 7936DEB5E6A236E8DCE91352D0617E3DB3BBE0FBAEBA5FB08BBEAC7590338C4D
File Size: 89.60 KB, 89600 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File has been packed
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • .adata
  • .aspack
  • 2+ executable sections
  • ASPack v2.12
  • HighEntropy
  • No Version Info
  • packed
  • upx
  • x86

Block Information

Total Blocks: 388
Potentially Malicious Blocks: 134
Whitelisted Blocks: 45
Unknown Blocks: 209

Visual Map

? x x x x x 0 x x x x x ? x x 0 x x ? ? x x x ? ? ? ? ? ? 0 ? ? ? ? ? ? ? x ? ? ? ? ? 0 ? ? x x ? x x x ? 0 ? x x x ? x ? ? x ? 0 x ? ? x ? ? x ? ? ? ? ? ? ? 0 x x 0 x x ? x ? x ? ? ? ? ? ? ? ? ? x ? ? x ? ? ? ? ? 0 ? ? ? x ? x ? ? x x 0 x x x ? ? ? ? ? ? ? ? ? ? ? x x x x x x x x ? x x 0 x ? ? x x x x 0 x x ? 0 x ? 0 ? x ? x x x x x x x ? ? x x x x x ? x x ? ? ? x 0 x ? ? 0 ? ? ? 0 0 x ? 0 ? ? 0 0 x ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? x ? x x ? x x x x x x ? ? x ? x 0 x x ? ? 0 x x x 0 0 x x x ? x ? ? x ? x ? x x x x x ? x x x x x x x x x 0 x 0 ? x ? x 0 0 x 0 x x x x x 0 ? ? ? ? ? x x 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 x ? ? ? ? ? ? ? 0 ? ? 0 ? ? ? ? ? ? ? ? x ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 ? x ? 0 ? ? ? ? ? ? 0 ? ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
\device\namedpipe\{d952f2d0-0bce-4b2b-8fff-2317f120fcc3} Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\infotmp.txt Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\2dec7a46.log Generic Write,Read Attributes
c:\windows\syswow64\2dec12c8.tmp Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\appmgmt.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\bits.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\certpropsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\fastuserswitchingcompatibility.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\gpsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\helpsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
Show More
c:\windows\syswow64\ias.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\iphlpsvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\irmon.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\lanmanserver.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\logonhours.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\msiscsi.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\nla.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\ntmssvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\nwcworkstation.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\nwsapagent.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\pcaudit.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\rasauto.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\rasman.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\remoteaccess.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\schedule.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\scpolicysvc.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\sens.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\sessionenv.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\sharedaccess.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\shellhwdetection.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\srservice.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\tapisrv.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\tokenbroker.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\uploadmgr.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\usermanager.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\winmgmt.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\wmdmpmsp.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\wmi.dll Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\windows\syswow64\wuauserv.dll Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

Key::Value Data API Name
HKLM\system\controlset001\control\keyboard layouts\e0010409::layout file KBDUS.DLL RegNtPreCreateKey
HKLM\system\controlset001\control\keyboard layouts\e0010409::layout text +�Y� RegNtPreCreateKey
HKLM\system\controlset001\services\certpropsvc\parameters::servicedll C:\WINDOWS\system32\CertPropSvc.dll RegNtPreCreateKey
HKLM\system\controlset001\services\scpolicysvc\parameters::servicedll C:\WINDOWS\system32\SCPolicySvc.dll RegNtPreCreateKey
HKLM\system\controlset001\services\lanmanserver\parameters::servicedll C:\WINDOWS\system32\lanmanserver.dll RegNtPreCreateKey
HKLM\system\controlset001\services\gpsvc\parameters::servicedll C:\WINDOWS\system32\gpsvc.dll RegNtPreCreateKey
HKLM\system\controlset001\services\iphlpsvc\parameters::servicedll C:\WINDOWS\system32\iphlpsvc.dll RegNtPreCreateKey
HKLM\system\controlset001\services\msiscsi\parameters::servicedll C:\WINDOWS\system32\msiscsi.dll RegNtPreCreateKey
HKLM\system\controlset001\services\schedule\parameters::servicedll C:\WINDOWS\system32\schedule.dll RegNtPreCreateKey
HKLM\system\controlset001\services\winmgmt\parameters::servicedll C:\WINDOWS\system32\winmgmt.dll RegNtPreCreateKey
Show More
HKLM\system\controlset001\services\sessionenv\parameters::servicedll C:\WINDOWS\system32\SessionEnv.dll RegNtPreCreateKey
HKLM\system\controlset001\services\tokenbroker\parameters::servicedll C:\WINDOWS\system32\TokenBroker.dll RegNtPreCreateKey
HKLM\system\controlset001\services\usermanager\parameters::servicedll C:\WINDOWS\system32\UserManager.dll RegNtPreCreateKey
HKLM\system\controlset001\services\rasauto\parameters::servicedll C:\WINDOWS\system32\Rasauto.dll RegNtPreCreateKey
HKLM\system\controlset001\services\rasman\parameters::servicedll C:\WINDOWS\system32\Rasman.dll RegNtPreCreateKey
HKLM\system\controlset001\services\remoteaccess\parameters::servicedll C:\WINDOWS\system32\Remoteaccess.dll RegNtPreCreateKey
HKLM\system\controlset001\services\sens\parameters::servicedll C:\WINDOWS\system32\SENS.dll RegNtPreCreateKey
HKLM\system\controlset001\services\sharedaccess\parameters::servicedll C:\WINDOWS\system32\Sharedaccess.dll RegNtPreCreateKey
HKLM\system\controlset001\services\tapisrv\parameters::servicedll C:\WINDOWS\system32\Tapisrv.dll RegNtPreCreateKey
HKLM\system\controlset001\services\wuauserv\parameters::servicedll C:\WINDOWS\system32\wuauserv.dll RegNtPreCreateKey
HKLM\system\controlset001\services\bits\parameters::servicedll C:\WINDOWS\system32\BITS.dll RegNtPreCreateKey
HKLM\system\controlset001\services\shellhwdetection\parameters::servicedll C:\WINDOWS\system32\ShellHWDetection.dll RegNtPreCreateKey
HKLM\system\controlset001\services\appmgmt\parameters::servicedll C:\WINDOWS\system32\AppMgmt.dll RegNtPreCreateKey

Windows API Usage

Category API
Service Control
  • OpenSCManager
  • StartService